[PATCH] dm-pcache: Fix use-after-free in kset_replay()

[PATCH] dm-pcache: Fix use-after-free in kset_replay()

[Wentao Liang]

When the generation of the segment referenced by a replayed key is
stale, kset_replay() releases the key with cache_key_put().  The caller
holds the only reference, so the key is freed, yet the function then
dereferences key->cache_pos to pin the segment.

Pin the segment before the key can be released.

Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/md/dm-pcache/cache_key.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
index e068e878231b..668c16a2e111 100644
--- a/drivers/md/dm-pcache/cache_key.c
+++ b/drivers/md/dm-pcache/cache_key.c
@@ -730,6 +730,12 @@ static int kset_replay(struct pcache_cache *cache, struct pcache_cache_kset_onme
 
 		__set_bit(key->cache_pos.cache_seg->cache_seg_id, cache->seg_map);
 
+		/*
+		 * Pin the segment while the key is still alive: the stale key
+		 * below is released and freed by cache_key_put().
+		 */
+		cache_seg_get(key->cache_pos.cache_seg);
+
 		/* Check if the segment generation is valid for insertion. */
 		if (key->seg_gen < key->cache_pos.cache_seg->gen) {
 			cache_key_put(key);
@@ -739,8 +745,6 @@ static int kset_replay(struct pcache_cache *cache, struct pcache_cache_kset_onme
 			cache_key_insert(&cache->req_key_tree, key, true);
 			spin_unlock(&cache_subtree->tree_lock);
 		}
-
-		cache_seg_get(key->cache_pos.cache_seg);
 	}
 
 	return 0;
-- 
2.34.1

Re: [PATCH] dm-pcache: Fix use-after-free in kset_replay()

[Mikulas Patocka]

Hi

This patch conflicts with the patch 
c2e894eac398b258f12fdec73ed6ba081047f7b3 (which also fixes the 
use-after-free condition).

Please, download the current kernel 7.3-rc4 and test if the bug is still 
present there. If it is, send a patch against 7.3-rc4.

Mikulas


On Thu, 17 Sep 2026, Wentao Liang wrote:

> When the generation of the segment referenced by a replayed key is
> stale, kset_replay() releases the key with cache_key_put().  The caller
> holds the only reference, so the key is freed, yet the function then
> dereferences key->cache_pos to pin the segment.
> 
> Pin the segment before the key can be released.
> 
> Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/md/dm-pcache/cache_key.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
> index e068e878231b..668c16a2e111 100644
> --- a/drivers/md/dm-pcache/cache_key.c
> +++ b/drivers/md/dm-pcache/cache_key.c
> @@ -730,6 +730,12 @@ static int kset_replay(struct pcache_cache *cache, struct pcache_cache_kset_onme
>  
>  		__set_bit(key->cache_pos.cache_seg->cache_seg_id, cache->seg_map);
>  
> +		/*
> +		 * Pin the segment while the key is still alive: the stale key
> +		 * below is released and freed by cache_key_put().
> +		 */
> +		cache_seg_get(key->cache_pos.cache_seg);
> +
>  		/* Check if the segment generation is valid for insertion. */
>  		if (key->seg_gen < key->cache_pos.cache_seg->gen) {
>  			cache_key_put(key);
> @@ -739,8 +745,6 @@ static int kset_replay(struct pcache_cache *cache, struct pcache_cache_kset_onme
>  			cache_key_insert(&cache->req_key_tree, key, true);
>  			spin_unlock(&cache_subtree->tree_lock);
>  		}
> -
> -		cache_seg_get(key->cache_pos.cache_seg);
>  	}
>  
>  	return 0;
> -- 
> 2.34.1
>